MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The file is a PDF identified as malicious by ML classifiers and ClamAV. It contains an embedded URL pointing to 'oniceh.ru', which is likely used for phishing or to download a secondary payload. The PDF structure itself does not contain readable text, but the presence of the malicious URL and the high confidence scores from detection engines strongly indicate a malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.9981
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://oniceh.ru/square?utm_term=idaho+drivers+license+test+answers
- https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60ec8c387b14134336dd4a73/1626115128347/nursing_behavioral_interview_questions_and_answers.pdf
- https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f0d561c08012782f7c5fa9/1626396001748/96959525140.pdf
- https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f833783306ea35e601ef6b/1626878840765/addition_without_regrouping_examples.pdf
- https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f9d41bb2d14e4dc6017a98/1626985499987/razipabaze.pdf
- https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e8d3c5a15ec47e0818572a/1625871301244/73323891044.pdf
- https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60edfa3b77fc8e778b5a5cae/1626208827568/39993607124.pdf
- https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f61a29e514952827cbb902/1626741289549/58863797597.pdf
- https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f97f74bc27a573ccc6a584/1626963828669/sacred_phoenix_of_nephthys_deck.pdf
- https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f78d4af307916d7ddf40e3/1626836298185/convert_3_images_to_one.pdf
- https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f2f0b527519501fc0cd041/1626534069960/46467647321.pdf
- https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60ed939df90efc25ed738529/1626182557287/73427090336.pdf
- https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e8619f8d022f7debee1089/1625842079778/internet_download_manager_download_with_serial_key.pdf
- https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f2d08536db64625199eeea/1626525829755/nadokowikosi.pdf
- https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f288ae27519501fc09af9d/1626507438295/problems_with_printing.pdf
- https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f4609650974615f92cad48/1626628247476/85747776299.pdf
- https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f670a0aaa839667718def3/1626763424829/kilikitisare.pdf
- https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f7998c1d7d066c9f928d2e/1626839436698/how_to_combine_files_on_macbook_pro.pdf
- https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e90cbef107ff2467e82c6d/1625885886495/four_paragraph_essay_example.pdf
- https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f6ef74290997146acdafd1/1626795892579/lysosomes_meaning_in_english.pdf
- https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60fa1494cb445e6277411c60/1627002004478/fezugike.pdf
- https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60fa03b4c9d06d60d5bc82fa/1626997684183/5785340009.pdf
- https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e7d79952059f1ec1e41393/1625806745676/i_am_number_four_full_movie_download_in_telugu.pdf
- https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f8ed213dc1753e7ba704a6/1626926369977/anglo_saxon_alfred_the_great.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000eab6.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEAB6 | 16792 bytes |
font_01_sfnt_off000102c8.bin522fddcecce62eb4016142237840132e867e7275b27b776364bae4283ddcb152 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x102C8 | 17056 bytes |
font_02_sfnt_off00012f9e.bin78197fa427016c86e8116e24a8e99479b37db573e0d2d6b6ad93755430ee5242 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12F9E | 10568 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.